Kubernetes Admission Controller Webhook Configuration Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•40

Detects when a modification (create, update, replace, delete, or patch) action is taken that affects mutating or validating webhook configurations in Kubernetes. Adversaries can abuse these configurations to achieve persistence, exfiltrate credentials, or escalate privileges within the cluster.